new(userspace/falco): add support for kernel side simple consumer.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
falcosecurity · Jan 10, 2022 · 48a2312 · 48a2312
1 parent 475ed0d
commit 48a2312
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp
@@ -1206,6 +1206,11 @@ int falco_init(int argc, char **argv)
 
 		if(!all_events)
 		{
+			// Drop EF_DROP_SIMPLE_CONS kernel side
+			inspector->set_simple_consumer();
+			// Eventually, drop any EF_DROP_SIMPLE_CONS event
+			// that reached userspace (there are some events that are not syscall-based
+			// like signaldeliver, that have the EF_DROP_SIMPLE_CONS flag)
 			inspector->set_drop_event_flags(EF_DROP_SIMPLE_CONS);
 		}